can't get to my Cisco Router http config interface nor can I ssh

[ttx336]

I have a block of 8 static IPs, I have NAT setup and can use the Internet just fine, however, unless I disconnect the LAN cable to the router's inteface (effectively shutting it down) I cannot get to my 2621's http config interface page... additionally, I cannot ssh into the PC but we can take this one step at a time... here's my config:

sh run
Building configuration...

Current configuration : 1045 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
enable secret 5 hooey
!
memory-size iomem 10
no aaa new-model
ip subnet-zero
ip cef
!
ip name-server 68.94.156.1
ip name-server 68.94.157.1
 --More--         !
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface Serial0/0
 no ip address
 shutdown
!
interface FastEthernet0/1
 ip address xxx.xxx.xxx.xxx 255.255.255.248
 ip nat outside
 duplex auto
 speed auto
!
interface Serial0/1
 no ip address
 shutdown
!
ip default-gateway xxx.xxx.xxx.xxx
ip nat inside source list 1 interface FastEthernet0/1 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
line con 0
 exec-timeout 0 0
 password blarney
 logging synchronous
 login
line aux 0
line vty 0 4
 password blarney
 login
line vty 5 15
 password blarney
 login
!
end
R1#

[SomeJoe7777 ACE - Geek · Accepted solution]

First, are you trying to reach the HTTP interface to the router from the LAN side (f0/0) or from the WAN side (f0/1)? From the LAN side should work fine using:

http://192.168.1.1

From the WAN side will not work until you put in a static NAT translation for port 80.

You will need that same static NAT translation for port 22 to use SSH as well.

[ttx336]

from the WAN... I will look into the static NAT, not sure I know how to do that but it makes sense now that you say it. I was trying to do it all dynamic

and, yes, I can do it just fine from the LAN

thank you!

[ttx336]

I have the static NAT set up as:

ip nat inside source static tcp 192.168.1.5 80 xxx.xxx.xxx.xxx 80

but I'm not sure about the options for extendable and no-payload, they don't seem to help when I try different ones...

I turned on

debug ip nat

and the incoming port numbers are seemingly random so that it totally messing this up, I think, anyway. Why don't I see the port number 80 coming in to be translated?

[ttx336]

Ooh, just realized it should be 192.168.1.1 for the NAT to the router, 192.168.1.5 is for the PC, I'll report back once I try that.

[ttx336]

that got me part of the way, now I can reach the router and I can ssh to the PC from a PC that is on the same WAN IPs as the R1 router, but if I try to ssh in or get to the R1 router via a PC that is not on the static IPs, it fails...

[SomeJoe7777 ACE - Geek]

Ya, to get into the router's HTTP interface, you would need:

ip nat inside source static tcp 192.168.1.1 80 xxx.xxx.xxx.xxx 80

What is the target of the SSH? The PC? In that case, the PC would need to be on a static IP in the private range (say 192.168.1.100), and then:

ip nat inside source static tcp 192.168.1.100 22 xxx.xxx.xxx.xxx 22

[ttx336]

Yes, the target of the ssh is the PC, it does have a static IP of 192.168.1.5 On a whim, I shut the wireless radio off in my iPad so that I'd be coming in completely off my network, and viola! It works fine, why is that? The IP on the RG's WAN is, of course, different than my static IPs... I wonder why I cannot remote in or ssh in from a PC that's on the RG's network. All of the PCs on that subnet work perfectly. But, kudos to you, Joe, is that your name? You are most definitely an ace with Cisco gear! Many, many thanks, this is the second time you have helped me, I've learned so much from you! Gary

[SomeJoe7777 ACE - Geek]

No problem, I've worked with networks and firewalls on many different brands of equipment for many years.

If you have an SSH server at 192.168.1.5 and the NAT static translation open for it, then you can (from outside your network) SSH to the outside public IP address of xxx.xxx.xxx.xxx. If you have a computer on the LAN that needs to SSH to that PC, then you need to use the local LAN IP address of 192.168.1.5. You cannot use the outside IP, as the Cisco will not allow "loopback connections" through a NAT translation.